NetSight
IP …
medium5.0

CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which…

Impact

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

Affected products

VendorProductAffected versions
KdeKonqueror
Versions 2.1.1, 2.2.2, 3.0, 3.0.1, 3.0.2, 3.0.3
KdeKonqueror Embedded
Version 0.1
RedhatAnalog Real-Time Synthesizer
Versions 2.1.1-5, 2.2-11
RedhatKdebase
Version 3.0.3-13
RedhatKdelibs
Versions 2.1.1-5, 2.2-11, 3.0.0-10, 3.1-10
RedhatKdelibs Devel
Versions 2.1.1-5, 2.2-11, 3.0.0-10, 3.0.3-8, 3.1-10
RedhatKdelibs Sound
Versions 2.1.1-5, 2.2-11
RedhatKdelibs Sound Devel
Versions 2.1.1-5, 2.2-11

References